Brand Impersonation Response

---
name: brand-impersonation-response
description: "Respond to a brand or executive impersonation incident — deepfaked executives, cloned support lines, fake apps, spoofed domains, or AI-generated scam content wearing your name. Use when a deepfake of a leader is circulating, customers report a fake version of your product or support channel, or to prepare the impersonation playbook before it happens. Produces an incident response: verification protocol, takedown sequencing by platform, customer and public communications, and the hardening plan. For general crisis comms use press-release/pm-crisis skills; for security incidents inside your systems use security-incident-response."
---

# Brand Impersonation Response Skill

Cheap generative tools made impersonation an industrial product: a CEO deepfake pushing a token, a cloned support line harvesting card numbers, a spoofed checkout collecting credentials. The attack isn't on your systems — it's on your *customers' trust*, using your face. Speed and sequencing decide the damage; this skill runs both.

## What This Skill Produces

- A **verification protocol** — confirm it's fake, preserve evidence, assess reach *before* amplifying it
- A **takedown sequence** by platform/registrar/store, with the escalation paths that actually work
- **Communications** for each audience: targeted customers, all customers, public, employees, and (deepfaked) the impersonated person
- A **hardening plan** so the next attempt lands softer

## Required Inputs

Ask for (if not already provided):
- **What's circulating**: the artifact (video/audio/site/app/account), where it lives, how it was discovered
- **The harm mechanism**: financial scam? credential harvesting? reputation/market manipulation? (Drives urgency and legal posture)
- **Reach so far** — views, victim reports, whether it's spreading or stagnant
- **Who's impersonated** — the brand, a product surface, or a named human (a deepfaked *person* is also a victim; the response includes them)

## Response Method

**Phase 1 — Verify and preserve (first hours).**
Confirm fabrication with the impersonated party directly (deepfakes are good; "that's obviously fake" is not a verification method). Preserve everything *before* takedowns delete the evidence: URLs, hashes, screen recordings, WHOIS, wallet addresses, timestamps — the takedown kills the scam, the evidence supports fraud referrals and platform escalation. Quietly assess reach; **do not publicly respond yet** — a statement about a 400-view scam gives it 40,000.

**Phase 2 — Contain (same day).**
Takedowns in parallel, sequenced by harm-per-hour:
- **Payment/credential harvesting first**: hosting provider + registrar (impersonation/phishing abuse reports), Google Safe Browsing / Microsoft SmartScreen flagging (kills most browser traffic faster than the registrar acts), payment processor fraud teams if cards are flowing
- **Platforms**: impersonation reports via *brand/IP channels*, not generic user reports — trademark-based reports move in hours where "report account" moves in weeks; file with rights documentation attached
- **App stores**: developer-impersonation + trademark claims through the formal IP channels
- Route it as **fraud, not just abuse**, where money moved: law enforcement referral (IC3 or local equivalent) — platforms escalate faster with a case number
Log every report: platform, ticket, time — the log *is* the escalation tool when nothing moves.

**Phase 3 — Communicate (as reach demands).**
The proportionality rule: **warn the targeted, inform the asking, broadcast only when reach forces it.**
- **Targeted/victimised customers** immediately: what happened, what we will *never* ask (the anchor line: "we will never DM you for payment/credentials/wallet transfers"), what to do if they engaged, one report channel
- **The impersonated executive** (deepfake cases): they're a victim, not just an asset — align their personal statement with the company's; one voice
- **Public statement** only past the reach threshold: short, factual, no link or screenshot of the fake, the never-ask anchor, the report channel. Never repeat the scam's claims in the correction (repetition entrenches)
- **Support + social teams** get the script *before* the public does — they're already getting the questions

**Phase 4 — Harden (the week after).**
Verification anchors customers can check (verified handles list on your domain, DMARC/BIMI, signed comms for high-stakes messages) · monitoring for the next round (domain-permutation watch, brand-mention alerts, app-store sweeps — impersonators retry) · the *internal* deepfake protocol (a "CEO" voice call requesting a transfer gets a callback on a known number — write it down now) · pre-registered abuse contacts at the platforms that were slow this time.

## Output Format

### Impersonation Response: [what's circulating] — [date]

**Verification:** [how fabrication was confirmed · evidence preserved (list) · reach assessment]

**Takedown log**
| Target | Channel used | Filed | Status | Escalation path |
|---|---|---|---|---|

**Communications** *(drafted, per audience)*: [targeted-customer notice · support script · public statement (with its reach trigger) · executive's personal statement if applicable]

**The never-ask anchor:** [the exact line, everywhere]

**Hardening plan:** [verification anchors · monitoring · internal deepfake protocol · owner + dates]

## Quality Checks

- [ ] Evidence was preserved before takedowns were filed
- [ ] Takedowns route through IP/trademark channels with documentation, not generic reports
- [ ] Public response is gated on a stated reach threshold, not reflex
- [ ] No communication links, screenshots, or restates the scam's content
- [ ] Money-moved cases include the law-enforcement referral
- [ ] The hardening plan includes the internal voice-deepfake protocol

## Anti-Patterns

- [ ] Do not amplify a low-reach scam with a high-reach denial — proportionality is the discipline
- [ ] Do not file generic "report this account" tickets when trademark channels exist — wrong queue, weeks lost
- [ ] Do not let takedowns destroy the evidence — preserve first, always
- [ ] Do not leave the deepfaked human out of the response — an executive learning the plan from the press release is a second incident
- [ ] Do not treat it as a one-off — impersonation that worked once is a campaign; monitoring is part of the response, not the postscript